K.I.S.S. Site to Site VPN Questions

rpmaps used Ask the Experts™
I am a small business owner who just opened a branch office.  I have some networking experience but have never set up a VPN.   In the main office I have 10 computers (Win XP) connected to a server running SBS 2003 r2.  I eventually will have up to 10 computers at the branch office.   Both offices have Comcast Business Internet with advertised speeds of 16 Mbps downloads/2Mbps Uploads, with the option to upgrade to 22/5.  Through my research on EE I have learned that I want to set up a IPsec tunnel between the two sites.  I have other specific questions that I have not been able to find an answer for:

1)   Do I need another server at the branch office if the main office server will maintain the necessary databases?
2)   I will be moving photographs and other image files between the two sites.  Will I notice a significant performance decline?   Would the upgrade to 22/5 be worth the extra monthly cost?
3)   The wide variety of VPN routers mentioned on this site is dizzying.  I am prepared to spend up to about $500 per router.  Which would be the simplest to set up and maintain?  It would be a great help if it had an easy to follow step by step setup wizard.
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
1) The branch office does not need another server *IF* the additional delay is acceptable.  If you're using database queries (mostly if not all the time), then you won't notice much delay.   If you're using file shares tp share files, you will notice the delay.

2) You will see a VPN slowdown if you transfer big files between the sites.  If you don't do it too often you'll be Ok.  (the issue is upload link saturation).

3) The Cisco 850 series will work.  It has a gui setup feature that will get you going simply.  If not, there are billions of Cisco experts on EE that will get you going. If you can specify what ip's and ports will be used to tranfer your images, something like a Cisco 1811 would let you "shape" the bandwidth of certain traffic, which could mitigate the image transfer issues

If you take the approach of adding a server to the second office and duplicating everything from one server to another, either manually keeping them in sync, and/or volume shadow copy, or other technologies.
Technology and Business Process Advisor
Most Valuable Expert 2013
1. Adding a second server would be the best idea in my opinion, IF YOU CAN AFFORD IT.

This will not help database performance, so why should you?
Redundancy.  SBS Domains can have additional domain controllers (NOT additional SBS Servers, but additional "standard" servers that are DCs).  This provides a level of redundancy so that:
   a) your users at the remote site can continue to access the internet and authenticate with the domain in the event that the original "home" office is down for whatever reason (power failure, internet failure, server crash, fire, theft, etc).
   b) you have a second DNS server in the event either server is unavailable due to an outage.
   c) you can setup DFS (Distribute File System) and replicate your data between sites (not e-mail, but file sharing data).  If either server fails, file sharing data is still available, though at a lower speed, to all users at both sites. If both servers are running, then you have full speed access to files at each location.  The DFS also provides a level of redundancy in the event of a disaster (It should not be considered your only backup though; a deletion on one server will NEARLY instantly delete it on the other and if you later realize that you shouldn't have deleted, you're out of luck (if it's not in shadow copy) plus there's corruption and other issues that DFS cannot protect you against (it doesn't cause them, but cannot reliably protect against them the same way a tape or disk based backup can).

2.  The upload speeds are the biggest problem here.  I would suggest FiOS 20/20 if you can afford it and if it's available.  If not, then you would I'd go with the 22/5 speeds...  That said, it does depend on your needs.  If you're transferring a couple dozen small jpgs once or twice a day, then it's a huge waste.   But if you're transferring large images constantly (Like full page size TIFFs), then the added speed will help greatly.  Another thing to consider is the capability of the VPN router.  CHEAP ones may be limited; I use a couple of NetGear FVS114's, CHEAP devices that do just fine for a site to site VPN, but the MAXIMUM VPN Throughput is 2.1 Mbit.  So if you went with the 5 Mbit upload speeds, it wouldn't do much good to use those devices.  Now, I recommend most of my clients get a Fortigate UTM (Unified Threat Management) device.  These devices can handle faster throughput AND provide greater protection as they include anti-virus scanning, limited spam filtering, router functionality, firewall, intrusion detection, intrusion prevention, and, of course, VPN.  Cost for the low end devices is about $700 Retail (you may be able to find them cheaper online).
Alan HardistyCo-Owner
Top Expert 2011
Here is my two penneth:
  1. Photgraphs and images are usually large in size and would tend to hog the upload bandwidth. If you upload 10 x 4Mb photographs to the remote server across a 2Mb link, it will take about 3 minutes 20 seconds to upload (ignoring any other traffic on the the link.  At 5Mb it will take about 1 minute 20 seconds.
  2. I would personally upgrade your speed to the 22/5 (as long as it is not a bank busting monthly price) and not worry about a server at the branch office.  Alternatively, stick to the 16/2 and install an entry level server at the branch office.
  3. Netgear produce the DGFV338 PROSAFE" 802.11G WIRELESS ADSL MODEM VPN FIREWALL ROUTER (http://www.netgear.com/Products/VPNandSSL/WirelessVPNFirewallRouters/DGFV338.aspx?detail=Specifications) which is capable of handling:
  • Throughput: Up to 50 Mbps WAN-to-LAN, up to 20 Mbps for 3DES throughput - this should be adequate for your needs.  The site-to-site VPN configuration is extremely simple and the routers are very reliable (in my experience).  Can't seem to find anywhere in the US that sells them though to get a price for you.  Sorry.


Thanks Experts for a clear to understand solution.   I will be posting a follow up question after closing.


I like the idea of the DFS.  I am assuming that the "mirroring" would be done in the background.  If that is true, and the identical images would reside on both servers, then internet speed would not be an issue.  Am I correct?

ALSO, do I need a static IP on one site or both?

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial